filter @message like /re/regex on the whole line (msg + raw)
@level = "ERROR"exact match — @level · @stream
and · or · not · ( )combine clauses in one filter
filter … | filter …chain filters — each pipe ANDs
| limit 1000cap to the newest N matches
Example: filter @message like /call-id/ | limit 1000